ClawHub
Back to skill

Security audit

量化交易信号

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a straightforward trading-signal script, but its documented install command uses an unsafe system-wide Python package installation pattern.

Install only if you are comfortable with a small Python script that retrieves market data and prints non-advisory trading signals. Do not run the documented install command against system Python; use a virtual environment and pinned dependencies instead, and treat the output as informational rather than financial advice.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Installation Bypasses System Package Protections

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 12
Vulnerability Type: Insecure dependency installation
Risk Level: Medium

Vulnerable Code

bash
pip3 install yfinance numpy --break-system-packages

Technical Analysis

The installation command retrieves mutable, unpinned releases of yfinance, numpy, and their transitive dependencies from the package index. The project provides no lockfile, version constraints, integrity hashes, or isolated environment instructions. Consequently, the code installed by this command can change without any corresponding change to the audited project.

The --break-system-packages option explicitly bypasses Python's externally managed environment protection and permits pip to modify the system Python environment. Package installation can execute package build or installation logic with the invoking user's privileges. Although the reviewed packages are not demonstrated to be malicious, this installation pattern unnecessarily increases supply-chain exposure and the potential for system-wide dependency conflicts.

Attack Path

  1. An attacker compromises a direct or transitive dependency release, its maintainer account, or the relevant package distribution channel.
  2. The user follows the documented installation command.
  3. Pip resolves the current, unpinned dependency versions rather than a previously reviewed dependency set.
  4. Malicious package installation logic executes with the user's privileges, or malicious runtime code is installed.
  5. Because --break-system-packages is enabled, the installation may alter the system Python environment rather than remaining confined to the project.
  6. The payload may execute during installation or when scripts/signals.py imports the affected package.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running pip or the script. This may permit access to that user's files, credentials, and ...[truncated 363 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove --break-system-packages and install dependencies in a dedicated virtual environment:
bash
python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.txt
  1. Pin direct and transitive dependencies to reviewed versions in a lockfile or fully resolved requirements file.
  2. Record cryptographic hashes and enforce them with pip's --require-hashes option.
  3. Review dependency provenance, release history, and known vulnerabilities before updating pinned versions.
  4. Use an automated dependency update process that reruns security and functional tests for every proposed upgrade.
  5. Avoid running package installation commands with elevated privileges.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

整体上，代码的主要目的与“量化交易信号系统”基本一致：它获取市场数据并基于技术指标生成交易倾向判断，使用了 MACD、RSI、均线、布林带等指标，未发现无关或越权能力，也没有额外敏感资源访问。 但描述与实现存在两点明显不一致：第一，描述明确列出 KDJ 作为支持指标，而代码中完全没有 KDJ 的计算或输出；第二，描述声称支持港股、美股、加密货币，代码仅通过 yfinance 按传入 symbol 获取数据，默认示例为 AAPL 和 BTC-USD，未体现港股符号处理或专门兼容逻辑，因此该支持范围至少未被代码充分证明。故应判定为存在描述与行为不完全匹配。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file hard-codes Chinese natural-language strings in the module docstring and all user-facing console output, such as labels, status messages, and advice. That creates a locale policy issue because the skill does not offer a language choice or explain that it is intentionally limited to Chinese users or regions.

Content

No source excerpt is available for this finding.